> How Cloudbeds processes guest data in its booking engine, which cookies the widget sets, what US transfers involve and which legal basis applies. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/cloudbeds E-commerce # Cloudbeds Preferences · [Official website](https://www.cloudbeds.com) Cloudbeds is a hospitality management platform providing property management, channel management, and online booking engine software for hotels, hostels, and vacation rentals. Its embedded booking widget collects guest personal data including names, contact details, and payment information. While the booking data relies on contract performance as its legal basis, the widget sets cookies requiring ePrivacy consent, and all guest data is processed in the United States. [Block Cloudbeds until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Preferences - Prior consent Required - Documented cookies 2 - Third-party domains 3 - Servers United States (Cloudbeds infrastructure, AWS) Overview ## What does Cloudbeds do? ## **What is Cloudbeds?** Cloudbeds is a comprehensive hospitality management platform used by hotels, hostels, bed and breakfasts, and vacation rental properties worldwide. It provides a property management system (PMS), channel manager for OTA distribution, and an embedded online booking engine that can be integrated into a property's website. When guests book directly through the Cloudbeds booking engine, their personal and payment data is captured, processed, and stored in Cloudbeds' US-based system. The platform also manages guest profiles, housekeeping, revenue management, and integrates with payment gateways. ## **What data does Cloudbeds collect?** Cloudbeds collects guest name, email address, phone number, nationality, date of birth (for identification purposes in some jurisdictions), arrival and departure dates, room preferences, special requests, and payment card details (tokenised through the payment gateway). It also collects IP addresses and device information when the booking widget loads. Guest profiles are retained across bookings to build stay history and preferences. In some countries, hospitality regulations require retention of guest identity data for specified periods. ## **GDPR and ePrivacy implications** The GDPR compliance profile of Cloudbeds is relatively straightforward for direct booking use cases. The collection of guest data necessary to process the reservation has a clear contract performance basis. The ePrivacy Directive still requires consent for non-essential cookies set by the booking widget script before booking begins. Particular attention is required for marketing communications: using guest email addresses for post-stay marketing requires a separate marketing consent, as the contract performance basis only covers the booking transaction itself. ## **Consent requirements** Consent for the booking data is not required as contract performance covers the processing. However, ePrivacy consent is required for non-essential cookies set by the Cloudbeds widget before booking begins. Guests must be informed through a privacy notice at the point of booking that their data will be processed by Cloudbeds in the US. For marketing emails post-stay, a separate opt-in marketing consent must be captured, typically via a checkbox on the booking form. This marketing consent must be separate from the booking acceptance. ## **Data transfers outside the EU** Cloudbeds is a US company and processes all guest and reservation data on US infrastructure. Standard Contractual Clauses apply as the transfer mechanism. Hospitality operators in the EU must disclose this transfer in their privacy policy, sign Cloudbeds' Data Processing Agreement, and document the transfer in their Records of Processing Activities. Guests must be informed of the US transfer before completing their booking. ## **Practical compliance steps** To use Cloudbeds compliantly: obtain ePrivacy consent before the booking widget script loads; display a privacy notice on the booking page identifying Cloudbeds as a processor and disclosing the US transfer; include a separate opt-in for marketing communications on the booking form; sign Cloudbeds' DPA; update your privacy policy; configure data retention periods in the Cloudbeds admin panel to align with local hospitality regulations and GDPR data minimisation; implement a process for handling guest data subject requests including erasure; and document the processing in your RoPA. Compliance ## Cloudbeds and the GDPR Cloudbeds is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract performance (Art. 6(1)(b) GDPR) for processing guest reservation data necessary to fulfil the booking. Consent (Art. 6(1)(a)) for non-essential tracking cookies set by the booking widget. Legal obligation (Art. 6(1)(c)) may apply for retention of guest records required by local hospitality regulations. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, CCPA ### Impact assessment (DPIA) A DPIA is generally not required for standard hotel booking deployments. It becomes advisable when Cloudbeds is integrated with payment processors, loyalty programs, or CRM systems that extend the guest data processing scope, or when guest profiling for marketing purposes goes beyond the original booking relationship. ### Sample text for your banner > This booking form is powered by Cloudbeds (Cloudbeds.com Inc., United States). To process your reservation, Cloudbeds will collect your name, email address, phone number, payment details, and stay preferences. This data will be processed in the United States. Your information is necessary to complete your booking. Please review our privacy policy for full details. Cookies and trackers ## What Cloudbeds sets and contacts - Tracking method JavaScript booking widget (iframe or direct embed), first-party and third-party cookies, server-side reservation and guest data processing - Server location United States (Cloudbeds infrastructure, AWS) - Data transferred outside the EU Cloudbeds is a US-based hospitality management platform. All reservation, guest profile, and payment data is processed on US infrastructure. Transfers rely on Standard Contractual Clauses under GDPR Article 46. ### Cookies set (2) | Name | Type | Duration | Purpose | | ----------- | ---------- | -------- | ------------------------------------------------------------------------------------- | | cb\_session | session | Session | Session identifier used to maintain the active booking flow state and guest form data | | cb\_visitor | persistent | 1 year | Anonymous visitor identifier used to track booking funnel behaviour and attribution | ### Third-party domains contacted (3) - `cloudbeds.com` - `hotels.cloudbeds.com` - `api.cloudbeds.com` Questions ## Frequently asked questions about Cloudbeds Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What data does Cloudbeds collect from guests? Cloudbeds collects guest name, email, phone number, nationality, date of birth, arrival and departure dates, room preferences, special requests, and payment card details (tokenised). IP addresses and device information are also collected when the booking widget loads. Guest profiles and stay history are retained across bookings. ### Does Cloudbeds require a GDPR consent banner? For booking data, no separate consent is required as contract performance covers the processing. However, ePrivacy consent is required for non-essential cookies the booking widget sets before guests start booking. Guests must also receive a privacy notice before entering their data, identifying Cloudbeds as a processor and disclosing the US data transfer. ### What is the legal basis for using Cloudbeds? Contract performance (Art. 6(1)(b)) is the primary basis for processing reservation and guest data necessary to fulfil the booking. Legal obligation (Art. 6(1)(c)) applies where local hospitality regulations require retention of guest registration data. Marketing communications to past guests require a separate consent. Consent (Art. 6(1)(a)) is required for non-essential booking widget cookies. ### Does Cloudbeds transfer data outside the EU? Yes. Cloudbeds is a US company and processes all reservation and guest data on US infrastructure. Standard Contractual Clauses apply as the GDPR transfer mechanism. European hospitality operators must sign Cloudbeds' DPA and disclose the US transfer in their guest-facing privacy policy. ### Do I need a DPIA for Cloudbeds? Generally not for standard property management and direct booking use cases. A DPIA becomes advisable when Cloudbeds is integrated with payment processors, loyalty programs, or CRM systems that significantly extend the guest data scope, or when detailed guest profiling for targeted marketing is implemented beyond the booking relationship. ### Can I use Cloudbeds to send post-stay marketing emails? Only with separate marketing consent. The contract performance basis covers reservation processing but not post-stay marketing. You must capture a separate, explicit marketing opt-in on the booking form, distinct from the booking acceptance. Do not pre-tick the marketing consent box. Guests who decline marketing must still be able to complete their booking. ### Are there EU-hosted alternatives to Cloudbeds? Mews is a Dutch hospitality platform with EU data residency. Apaleo is a German-founded cloud PMS with GDPR-compliant EU infrastructure. Lodgify offers EU data processing options. For smaller properties, open-source hotel PMS tools like Hotelogix can be self-hosted on EU infrastructure for full data sovereignty. ### How do I handle guest data subject requests for Cloudbeds data? For access requests, export the guest profile and booking history from the Cloudbeds admin panel. For erasure requests, delete the guest profile, anonymise booking records where retention is required by law for accounting or hospitality regulation purposes, and confirm deletion in writing. Document all requests in your data subject request log. Note that some booking records may need to be retained for legal obligation periods before erasure. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [NACEX](https://www.flowconsent.com/en/services/ecommerce/nacex) [NACEX is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. NACEX integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, NACEX helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/nacex) [Preferences](https://www.flowconsent.com/en/services/ecommerce/nacex) · ### [Adalte](https://www.flowconsent.com/en/services/ecommerce/adalte) [Adalte is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Adalte provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Adalte helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/adalte) [Marketing](https://www.flowconsent.com/en/services/ecommerce/adalte) · ### [Cleeng](https://www.flowconsent.com/en/services/ecommerce/cleeng) [Cleeng is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Cleeng integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Cleeng helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/cleeng) [E-commerce](https://www.flowconsent.com/en/services/ecommerce/cleeng) · ### [Bold Subscriptions](https://www.flowconsent.com/en/services/ecommerce/bold-subscriptions) [Bold Subscriptions is a subscription management platform that enables businesses to offer recurring billing and subscription-based products or services. It handles the full subscription lifecycle including trial periods, plan upgrades, payment retries, and churn management. Bold Subscriptions integrates with major payment gateways and e-commerce platforms, providing revenue analytics and customer insights. Its flexible API and customizable checkout flows help businesses launch subscriptions with confidence.](https://www.flowconsent.com/en/services/ecommerce/bold-subscriptions) [Preferences](https://www.flowconsent.com/en/services/ecommerce/bold-subscriptions) · ### [Priice](https://www.flowconsent.com/en/services/ecommerce/priice) [Priice is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Priice integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Priice helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/priice) [Preferences](https://www.flowconsent.com/en/services/ecommerce/priice) · ### [Microsoft Dynamics 365 Commerce](https://www.flowconsent.com/en/services/ecommerce/microsoft-dynamics-365-commerce) [Microsoft Dynamics 365 Commerce offers a scalable e-commerce solution designed to help merchants sell products and services online. Its feature set includes customizable storefronts, multi-currency support, automated tax calculations, and advanced shipping options. Microsoft Dynamics 365 Commerce integrates with leading payment gateways, marketing platforms, and fulfillment services. Built-in analytics and reporting tools help merchants track performance, optimize conversions, and make data-driven.](https://www.flowconsent.com/en/services/ecommerce/microsoft-dynamics-365-commerce) [Preferences](https://www.flowconsent.com/en/services/ecommerce/microsoft-dynamics-365-commerce) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)